/* file_access.c

 *

 * Wiretap Library

 * Copyright (c) 1998 by Gilbert Ramirez <gram@alumni.rice.edu>

 *

 * SPDX-License-Identifier: GPL-2.0-or-later

 */

#include "config.h"

#define WS_LOG_DOMAIN LOG_DOMAIN_WIRETAP

#include "wtap-int.h"

#include <assert.h>

#include <string.h>

#include <stdlib.h>

#include <errno.h>

#include <wsutil/file_util.h>

#include <wsutil/file_compressed.h>

#include <wsutil/tempfile.h>

#ifdef HAVE_PLUGINS

#include <wsutil/plugins.h>

#endif

#include <wsutil/ws_assert.h>

#include "wtap_module.h"

#include "wtap_modules.h"

#include "file_wrappers.h"

#include "required_file_handlers.h"

#include <wsutil/array.h>

#include <wsutil/buffer.h>

#include <wsutil/str_util.h>

#include "lanalyzer.h"

#include "ngsniffer.h"

#include "radcom.h"

#include "ascendtext.h"

#include "nettl.h"

#include "libpcap.h"

#include "snoop.h"

#include "iptrace.h"

#include "iseries.h"

#include "netmon.h"

#include "netxray.h"

#include "toshiba.h"

#include "eyesdn.h"

#include "i4btrace.h"

#include "csids.h"

#include "pppdump.h"

#include "peekclassic.h"

#include "peektagged.h"

#include "vms.h"

#include "dbs-etherwatch.h"

#include "visual.h"

#include "cosine.h"

#include "5views.h"

#include "erf.h"

#include "hcidump.h"

#include "logcat.h"

#include "logcat_text.h"

#include "json.h"

#include "json_log.h"

#include "mmodule.h"

#include "observer.h"

#include "k12.h"

#include "ber.h"

#include "catapult_dct2000.h"

#include "mp4.h"

#include "mp2t.h"

#include "mpeg.h"

#include "netscreen.h"

#include "commview.h"

#include "pcapng.h"

#include "aethra.h"

#include "btsnoop.h"

#include "tnef.h"

#include "dct3trace.h"

#include "packetlogger.h"

#include "daintree-sna.h"

#include "netscaler.h"

#include "mime_file.h"

#include "ipfix.h"

#include "vwr.h"

#include "camins.h"

#include "stanag4607.h"

#include "capsa.h"

#include "nettrace_3gpp_32_423.h"

#include "mplog.h"

#include "dpa400.h"

#include "rfc7468.h"

#include "ruby_marshal.h"

#include "systemd_journal.h"

#include "log3gpp.h"

#include "candump.h"

#include "busmaster.h"

#include "cllog.h"

#include "blf.h"

#include "eri_enb_log.h"

#include "autosar_dlt.h"

#include "rtpdump.h"

#include "ems.h"

#include "ttl.h"

#include "peak-trc.h"

#include "netlog.h"

#include "procmon.h"

/*

 * Add an extension, and all compressed versions thereof if requested,

 * to a GSList of extensions.

 */

static GSList *

add_extensions(GSList *extensions, const char *extension,

    GSList *compression_type_extensions)

{

  /*

   * Add the specified extension.

   */

  extensions = g_slist_prepend(extensions, g_strdup(extension));

  /*

   * Add whatever compressed versions we were supplied.

   */

  for (GSList *compression_type_extension = compression_type_extensions;

      compression_type_extension != NULL;

      compression_type_extension = g_slist_next(compression_type_extension)) {

    extensions = g_slist_prepend(extensions,

        ws_strdup_printf("%s.%s", extension,

            (const char *)compression_type_extension->data));

  }

  return extensions;

}

static const struct file_extension_info* file_type_extensions;

static GArray* file_type_extensions_arr;

void

wtap_init_file_type_extensions(const struct file_extension_info* file_extensions, unsigned num_extensions)

{

  file_type_extensions_arr = g_array_new(false,true,sizeof(struct file_extension_info));

  g_array_append_vals(file_type_extensions_arr, file_extensions, num_extensions);

  file_type_extensions = (struct file_extension_info*)(void *)file_type_extensions_arr->data;

}

void

wtap_register_file_type_extension(const struct file_extension_info *ei)

{

  g_array_append_val(file_type_extensions_arr,*ei);

  file_type_extensions = (const struct file_extension_info*)(void *)file_type_extensions_arr->data;

}

int

wtap_get_num_file_type_extensions(void)

{

  return file_type_extensions_arr->len;

}

const char *

wtap_get_file_extension_type_name(int extension_type)

{

  return file_type_extensions[extension_type].name;

}

static GSList *

add_extensions_for_file_extensions_type(int extension_type, GSList *extensions,

    GSList *compression_type_extensions)

{

  char **extensions_set, **extensionp, *extension;

  /*

   * Split the extension-list string into a set of extensions.

   */

  extensions_set = g_strsplit(file_type_extensions[extension_type].extensions,

      ";", 0);

  /*

   * Add each of those extensions to the list.

   */

  for (extensionp = extensions_set; *extensionp != NULL; extensionp++) {

    extension = *extensionp;

    /*

     * Add the extension, and all compressed variants

     * of it.

     */

    extensions = add_extensions(extensions, extension,

        compression_type_extensions);

  }

  g_strfreev(extensions_set);

  return extensions;

}

/* Return a list of file extensions that are used by the specified file

 * extension type.

 *

 * All strings in the list are allocated with g_malloc() and must be freed

 * with g_free().

 */

GSList *

wtap_get_file_extension_type_extensions(unsigned extension_type)

{

  GSList *extensions, *compression_type_extensions;

  if (extension_type >= file_type_extensions_arr->len)

    return NULL; /* not a valid extension type */

  extensions = NULL; /* empty list, to start with */

  /*

   * Get compression-type extensions, if any.

   */

  compression_type_extensions = ws_get_all_compression_type_extensions_list();

  /*

   * Add all this file extension type's extensions, with compressed

   * variants.

   */

  extensions = add_extensions_for_file_extensions_type(extension_type,

      extensions, compression_type_extensions);

  g_slist_free(compression_type_extensions);

  return g_slist_reverse(extensions);

}

/*

 * The open_file_* routines must return:

 *

 *  WTAP_OPEN_ERROR on an I/O error;

 *

 *  WTAP_OPEN_MINE if the file they're reading is one of the types

 *      it handles;

 *

 *  WTAP_OPEN_NOT_MINE if the file they're reading isn't the type

 *      they're checking for.

 *

 * If the routine handles this type of file, it must set the "file_type"

 * field in the "struct wtap" to the type of the file.

 *

 * Note that the routine does *not* have to free the private data pointer on

 * error. The caller takes care of that by calling wtap_close on error.

 * (See https://gitlab.com/wireshark/wireshark/-/issues/8518)

 *

 * However, the caller *does* have to free the private data pointer when

 * returning WTAP_OPEN_NOT_MINE, since the next file type will be called

 * and will likely just overwrite the pointer.

 *

 * The names are used in file open dialogs to select, for files that

 * don't have magic numbers and that could potentially be files of

 * more than one type based on the heuristics, a particular file

 * type to interpret it as, if the file name has no extension, the

 * extension isn't sufficient to determine the appropriate file type,

 * or the extension is wrong.

 *

 * NOTE: when adding file formats to this list you may also want to add them

 * to the following files so that the various desktop environments will

 * know that Wireshark can open the file:

 *  1) resources/freedesktop/org.wireshark.Wireshark-mime.xml (for freedesktop.org environments)

 *  2) packaging/macosx/WiresharkInfo.plist.in (for macOS)

 *

 * If your file format has a commonly-used extension (e.g., ".pcap") then you

 * should probably also add it to file_type_extensions_base[] (in this file),

 * to the list of "<glob pattern=...>" entries for this file format in

 * resources/freedesktop/org.wireshark.Wireshark-mime.xml, to the

 * CFBundleTypeExtensions array for this file format in

 * packaging/macosx/WiresharkInfo.plist, and to the PushFileExtensions macro

 * in packaging/nsis/wireshark-common.nsh and the File Associations in

 * packaging/wix/ComponentGroups.wxi (for Windows).

 */

static const struct open_info open_info_base[] = {

  /* Open routines that look for magic numbers */

  { "Wireshark/tcpdump/... - pcap",           OPEN_INFO_MAGIC,     libpcap_open,             NULL,   NULL, NULL },

  { "Wireshark/... - pcapng",                 OPEN_INFO_MAGIC,     pcapng_open,              NULL, NULL, NULL },

  { "Sniffer (DOS)",                          OPEN_INFO_MAGIC,     ngsniffer_open,           NULL,       NULL, NULL },

  { "Snoop, Shomiti/Finisar Surveyor",        OPEN_INFO_MAGIC,     snoop_open,               NULL,       NULL, NULL },

  { "AIX iptrace",                            OPEN_INFO_MAGIC,     iptrace_open,             NULL,       NULL, NULL },

  { "Microsoft Network Monitor",              OPEN_INFO_MAGIC,     netmon_open,              NULL,       NULL, NULL },

  { "Cinco NetXray/Sniffer (Windows)",        OPEN_INFO_MAGIC,     netxray_open,             NULL,       NULL, NULL },

  { "RADCOM WAN/LAN analyzer",                OPEN_INFO_MAGIC,     radcom_open,              NULL,       NULL, NULL },

  { "HP-UX nettl trace",                      OPEN_INFO_MAGIC,     nettl_open,               NULL,       NULL, NULL },

  { "Visual Networks traffic capture",        OPEN_INFO_MAGIC,     visual_open,              NULL,       NULL, NULL },

  { "InfoVista 5View capture",                OPEN_INFO_MAGIC,     _5views_open,             NULL,       NULL, NULL },

  { "Viavi Observer",                         OPEN_INFO_MAGIC,     observer_open,            NULL,       NULL, NULL },

  { "Savvius tagged",                         OPEN_INFO_MAGIC,     peektagged_open,          NULL,       NULL, NULL },

  { "Colasoft Capsa",                         OPEN_INFO_MAGIC,     capsa_open,               NULL,       NULL, NULL },

  { "DBS Etherwatch (VMS)",                   OPEN_INFO_MAGIC,     dbs_etherwatch_open,      NULL,       NULL, NULL },

  { "Tektronix K12xx 32-bit .rf5 format",     OPEN_INFO_MAGIC,     k12_open,                 NULL,       NULL, NULL },

  { "Catapult DCT2000 trace (.out format)",   OPEN_INFO_MAGIC,     catapult_dct2000_open,    NULL,       NULL, NULL },

  { "Aethra .aps file",                       OPEN_INFO_MAGIC,     aethra_open,              NULL,       NULL, NULL },

  { "Symbian OS btsnoop",                     OPEN_INFO_MAGIC,     btsnoop_open,             "log",      NULL, NULL },

  { "EyeSDN USB S0/E1 ISDN trace format",     OPEN_INFO_MAGIC,     eyesdn_open,              NULL,       NULL, NULL },

  { "Transport-Neutral Encapsulation Format", OPEN_INFO_MAGIC,     tnef_open,                NULL,       NULL, NULL },

  /* 3GPP TS 32.423 Trace must come before MIME Files as it's XML based*/

  { "3GPP TS 32.423 Trace format",            OPEN_INFO_MAGIC,     nettrace_3gpp_32_423_file_open, NULL, NULL, NULL },

  /* Gammu DCT3 trace must come before MIME files as it's XML based*/

  { "Gammu DCT3 trace",                       OPEN_INFO_MAGIC,     dct3trace_open,           NULL,       NULL, NULL },

  { "BLF Logfile",                            OPEN_INFO_MAGIC,     blf_open,                 NULL,     NULL, NULL },

  { "AUTOSAR DLT Logfile",                    OPEN_INFO_MAGIC,     autosar_dlt_open,         NULL,     NULL, NULL },

  { "TTL Logfile",                            OPEN_INFO_MAGIC,     ttl_open,                 NULL,     NULL, NULL },

  { "RTPDump files",                          OPEN_INFO_MAGIC,     rtpdump_open,             NULL, NULL, NULL },

  { "MIME Files Format",                      OPEN_INFO_MAGIC,     mime_file_open,           NULL,       NULL, NULL },

  { "Micropross mplog",                       OPEN_INFO_MAGIC,     mplog_open,               NULL,   NULL, NULL },

  { "Unigraf DPA-400 capture",                OPEN_INFO_MAGIC,     dpa400_open,              NULL,       NULL, NULL },

  { "RFC 7468 files",                         OPEN_INFO_MAGIC,     rfc7468_open,             NULL,  NULL, NULL },

  { "MS Procmon Files",                       OPEN_INFO_MAGIC,     procmon_open,             NULL,  NULL, NULL },

  /* Open routines that have no magic numbers and require heuristics. */

  { "Novell LANalyzer",                       OPEN_INFO_HEURISTIC, lanalyzer_open,           "tr1",      NULL, NULL },

  /*

   * PacketLogger must come before MPEG, because its files

   * are sometimes grabbed by mpeg_open.

   */

  { "macOS PacketLogger",                     OPEN_INFO_HEURISTIC, packetlogger_open,        "pklg",     NULL, NULL },

  /* Some MPEG files have magic numbers, others just have heuristics. */

  { "MPEG",                                   OPEN_INFO_HEURISTIC, mpeg_open,                "mpeg;mpg;mp3",  NULL, NULL },

  { "Daintree SNA",                           OPEN_INFO_HEURISTIC, daintree_sna_open,        "dcf",      NULL, NULL },

  { "STANAG 4607 Format",                     OPEN_INFO_HEURISTIC, stanag4607_open,          NULL,       NULL, NULL },

  { "ASN.1 Basic Encoding Rules",             OPEN_INFO_HEURISTIC, ber_open,                 NULL,       NULL, NULL },

  /*

   * I put NetScreen *before* erf, because there were some

   * false positives with my test-files (Sake Blok, July 2007)

   *

   * I put VWR *after* ERF, because there were some cases where

   * ERF files were misidentified as vwr files (Stephen

   * Donnelly, August 2013; see bug 9054)

   *

   * I put VWR *after* Peek Classic, CommView, iSeries text,

   * Toshiba text, K12 text, VMS tcpiptrace text, and NetScaler,

   * because there were some cases where files of those types were

   * misidentified as vwr files (Guy Harris, December 2013)

   */

  { "NetScreen snoop text file",              OPEN_INFO_HEURISTIC, netscreen_open,           "txt",      NULL, NULL },

  { "Endace ERF capture",                     OPEN_INFO_HEURISTIC, erf_open,                 "erf",      NULL, NULL },

  { "IPFIX File Format",                      OPEN_INFO_HEURISTIC, ipfix_open,               "pfx;ipfix",NULL, NULL },

  { "K12 text file",                          OPEN_INFO_HEURISTIC, k12text_open,             "txt",      NULL, NULL },

  { "Savvius classic",                        OPEN_INFO_HEURISTIC, peekclassic_open,         "pkt;tpc;apc;wpz", NULL, NULL },

  { "pppd log (pppdump format)",              OPEN_INFO_HEURISTIC, pppdump_open,             NULL,       NULL, NULL },

  { "IBM iSeries comm. trace",                OPEN_INFO_HEURISTIC, iseries_open,             "txt",      NULL, NULL },

  { "I4B ISDN trace",                         OPEN_INFO_HEURISTIC, i4btrace_open,            NULL,       NULL, NULL },

  { "MPEG2 transport stream",                 OPEN_INFO_HEURISTIC, mp2t_open,                "mp2t;ts;mpg",   NULL, NULL },

  { "CSIDS IPLog",                            OPEN_INFO_HEURISTIC, csids_open,               NULL,       NULL, NULL },

  { "TCPIPtrace (VMS)",                       OPEN_INFO_HEURISTIC, vms_open,                 "txt",      NULL, NULL },

  { "CoSine IPSX L2 capture",                 OPEN_INFO_HEURISTIC, cosine_open,              "txt",      NULL, NULL },

  { "Bluetooth HCI dump",                     OPEN_INFO_HEURISTIC, hcidump_open,             NULL,       NULL, NULL },

  { "TamoSoft CommView NCF",                  OPEN_INFO_HEURISTIC, commview_ncf_open,        "ncf",      NULL, NULL },

  { "TamoSoft CommView NCFX",                 OPEN_INFO_HEURISTIC, commview_ncfx_open,       "ncfx",      NULL, NULL },

  { "NetScaler",                              OPEN_INFO_HEURISTIC, nstrace_open,             "cap",      NULL, NULL },

  { "Android Logcat Binary format",           OPEN_INFO_HEURISTIC, logcat_open,              "logcat",   NULL, NULL },

  { "Android Logcat Text formats",            OPEN_INFO_HEURISTIC, logcat_text_open,         "txt",      NULL, NULL },

  { "Candump log",                            OPEN_INFO_HEURISTIC, candump_open,             NULL,       NULL, NULL },

  { "Busmaster log",                          OPEN_INFO_HEURISTIC, busmaster_open,           NULL,       NULL, NULL },

  { "CSS Electronics CLX000 CAN log",         OPEN_INFO_MAGIC,     cllog_open,               "txt",      NULL, NULL },

  { "Ericsson eNode-B raw log",               OPEN_INFO_MAGIC,     eri_enb_log_open,         NULL,       NULL, NULL },

  { "Systemd Journal",                        OPEN_INFO_HEURISTIC, systemd_journal_open,     "log;jnl;journal",      NULL, NULL },

  { "PEAK CAN TRC log",                       OPEN_INFO_HEURISTIC, peak_trc_open,            "trc",      NULL, NULL },

  /* ASCII trace files from Telnet sessions. */

  { "Lucent/Ascend access server trace",      OPEN_INFO_HEURISTIC, ascend_open,              "txt",      NULL, NULL },

  { "Toshiba Compact ISDN Router snoop",      OPEN_INFO_HEURISTIC, toshiba_open,             "txt",      NULL, NULL },

  { "EGNOS Message Server (EMS) file",        OPEN_INFO_HEURISTIC, ems_open,                 "ems",      NULL, NULL },

  /* NetLog needs to be before JSON because it is a specifically formatted JSON file */

  { "NetLog",                                 OPEN_INFO_HEURISTIC, netlog_open,              "json",     NULL, NULL },

  /* JSON Log needs to be before JSON because it handles a variety of JSON logs */

  { "JSON Log",                               OPEN_INFO_HEURISTIC, json_log_open,            "json;jsonl;log", NULL, NULL },

  { "JavaScript Object Notation",             OPEN_INFO_HEURISTIC, json_open,                "json",     NULL, NULL },

  { "Bachmann M-Module File",                 OPEN_INFO_HEURISTIC, mmodule_open,             "m",        NULL, NULL },

  { "Ruby Marshal Object",                    OPEN_INFO_HEURISTIC, ruby_marshal_open,        "",         NULL, NULL },

  { "3gpp phone log",                         OPEN_INFO_MAGIC,     log3gpp_open,             "log",      NULL, NULL },

  { "MP4 media file",                         OPEN_INFO_MAGIC,     mp4_open,                 "mp4",      NULL, NULL },

  /* Extremely weak heuristics - put them at the end. */

  { "Ixia IxVeriWave .vwr Raw Capture",       OPEN_INFO_HEURISTIC, vwr_open,                 "vwr",      NULL, NULL },

  { "CAM Inspector file",                     OPEN_INFO_HEURISTIC, camins_open,              "camins",   NULL, NULL },

};

/* this is only used to build the dynamic array on load, do NOT use this

 * for anything else, because the size of the actual array will change if

 * Lua scripts register a new file reader.

 */

#define N_OPEN_INFO_ROUTINES  array_length(open_info_base)

static GArray *open_info_arr;

/* this always points to the top of the created array */

struct open_info *open_routines;

/* this points to the first OPEN_INFO_HEURISTIC type in the array */

static unsigned heuristic_open_routine_idx;

static void

set_heuristic_routine(void)

{

  unsigned i;

  ws_assert(open_info_arr != NULL);

  for (i = 0; i < open_info_arr->len; i++) {

    if (open_routines[i].type == OPEN_INFO_HEURISTIC) {

      heuristic_open_routine_idx = i;

      break;

    }

    /* sanity check */

    ws_assert(open_routines[i].type == OPEN_INFO_MAGIC);

  }

  ws_assert(heuristic_open_routine_idx > 0);

}

void

init_open_routines(void)

{

  unsigned int i;

  struct open_info *i_open;

  if (open_info_arr)

    return;

  open_info_arr = g_array_new(true,true,sizeof(struct open_info));

  g_array_append_vals(open_info_arr, open_info_base, N_OPEN_INFO_ROUTINES);

  open_routines = (struct open_info *)(void*) open_info_arr->data;

  /* Populate the extensions_set list now */

  for (i = 0, i_open = open_routines; i < open_info_arr->len; i++, i_open++) {

    if (i_open->extensions != NULL)

      i_open->extensions_set = g_strsplit(i_open->extensions, ";", 0);

  }

  set_heuristic_routine();

}

/*

 * Registers a new file reader - currently only called by wslua code for

 * Lua readers and by compiled file reader plugins.

 *

 * If first_routine is true, the reader added before other readers of its

 * type (magic or heuristic).  This should be done only in cases where

 * this reader's open test must be performed early, to avoid false

 * positives for other readers' tests treating files for this reader

 * as being for another reader.

 *

 * XXX - given that there is no guarantee that registration routines will

 * be called in a given order, all this really does is divide readers for

 * a given type (magic or heuristic) into two categories, with open routines

 * for readers in the first category (first_routine true) all being called

 * before readers in the second category; it does not guarantee a particular

 * total order for open routines.

 *

 * Checks for an existing reader of the same name and errors if it finds one;

 * if you want to handle that condition more gracefully, call

 * wtap_has_open_info() first.

 */

void

wtap_register_open_info(struct open_info *oi, const bool first_routine)

{

  if (!oi || !oi->name) {

    ws_error("No open_info name given to register");

    return;

  }

  /* verify name doesn't already exist */

  if (wtap_has_open_info(oi->name)) {

    ws_error("Name given to register_open_info already exists");

    return;

  }

  if (oi->extensions != NULL)

    oi->extensions_set = g_strsplit(oi->extensions, ";", 0);

  /* if it's magic and first, prepend it; if it's heuristic and not first,

     append it; if it's anything else, stick it in the middle */

  if (first_routine && oi->type == OPEN_INFO_MAGIC) {

    g_array_prepend_val(open_info_arr, *oi);

  } else if (!first_routine && oi->type == OPEN_INFO_HEURISTIC) {

    g_array_append_val(open_info_arr, *oi);

  } else {

    g_array_insert_val(open_info_arr, heuristic_open_routine_idx, *oi);

  }

  open_routines = (struct open_info *)(void*) open_info_arr->data;

  set_heuristic_routine();

}

/* De-registers a file reader by removing it from the GArray based on its name.

 * This function must NOT be called during wtap_open_offline(), since it changes the array.

 * Note: this function will error if it doesn't find the given name; if you want to handle

 * that condition more gracefully, call wtap_has_open_info() first.

 */

void

wtap_deregister_open_info(const char *name)

{

  unsigned i;

  if (!name) {

    ws_error("Missing open_info name to de-register");

    return;

  }

  for (i = 0; i < open_info_arr->len; i++) {

    if (open_routines[i].name && strcmp(open_routines[i].name, name) == 0) {

      g_strfreev(open_routines[i].extensions_set);

      open_info_arr = g_array_remove_index(open_info_arr, i);

      set_heuristic_routine();

      return;

    }

  }

  ws_error("deregister_open_info: name not found");

}

/* Determines if a open routine short name already exists

 */

bool

wtap_has_open_info(const char *name)

{

  unsigned i;

  if (!name) {

    ws_error("No name given to wtap_has_open_info!");

    return false;

  }

  for (i = 0; i < open_info_arr->len; i++) {

    if (open_routines[i].name && strcmp(open_routines[i].name, name) == 0) {

      return true;

    }

  }

  return false;

}

bool

wtap_uses_lua_filehandler(const wtap* wth)

{

  if (wth && wth->wslua_data != NULL) {

    /*

     * Currently, wslua_data is set if and only if using a Lua

     * file handler.

     */

    return true;

  }

  return false;

}

/*

 * Visual C++ on Win32 systems doesn't define these.  (Old UNIX systems don't

 * define them either.)

 *

 * Visual C++ on Win32 systems doesn't define S_IFIFO, it defines _S_IFIFO.

 */

#ifndef S_ISREG

#define S_ISREG(mode)   (((mode) & S_IFMT) == S_IFREG)

#endif

#ifndef S_IFIFO

#define S_IFIFO _S_IFIFO

#endif

#ifndef S_ISFIFO

#define S_ISFIFO(mode)  (((mode) & S_IFMT) == S_IFIFO)

#endif

#ifndef S_ISDIR

#define S_ISDIR(mode)   (((mode) & S_IFMT) == S_IFDIR)

#endif

/* returns the 'type' number to use for wtap_open_offline based on the

 * passed-in name (the name in the open_info struct). It returns WTAP_TYPE_AUTO

 * on failure, which is the number 0. The 'type' number is the entry's index+1,

 * because that's what wtap_open_offline() expects it to be.

 */

unsigned int

open_info_name_to_type(const char *name)

{

  unsigned int i;

  if (!name)

    return WTAP_TYPE_AUTO;

  for (i = 0; i < open_info_arr->len; i++) {

    if (open_routines[i].name != NULL &&

        strcmp(name, open_routines[i].name) == 0)

      return i+1;

  }

  return WTAP_TYPE_AUTO; /* no such file type */

}

static char *

get_file_extension(const char *pathname)

{

  char *filename;

  char **components;

  size_t ncomponents;

  char *extensionp;

  /*

   * Is the pathname empty?

   */

  if (strcmp(pathname, "") == 0)

    return NULL; /* no extension */

  /*

   * Find the last component of the pathname.

   */

  filename = g_path_get_basename(pathname);

  /*

   * Does it have an extension?

   */

  if (strchr(filename, '.') == NULL) {

    g_free(filename);

    return NULL; /* no extension whatsoever */

  }

  /*

   * Yes. Fold it to lowercase, since open_routines[] has

   * its extensions in lowercase.

   */

  ascii_strdown_inplace(filename);

  /*

   * Split it into components separated by ".".

   */

  components = g_strsplit(filename, ".", 0);

  g_free(filename);

  /*

   * Count the components.

   */

  for (ncomponents = 0; components[ncomponents] != NULL; ncomponents++)

    ;

  if (ncomponents == 0) {

    g_strfreev(components);

    return NULL; /* no components */

  }

  if (ncomponents == 1) {

    g_strfreev(components);

    return NULL; /* only one component, with no "." */

  }

  /*

   * Get compression-type extensions, if any.

   */

  GSList *compression_type_extensions = ws_get_all_compression_type_extensions_list();

  /*

   * Is the last component one of the extensions used for compressed

   * files?

   */

  extensionp = components[ncomponents - 1];

  for (GSList *compression_type_extension = compression_type_extensions;

      compression_type_extension != NULL;

      compression_type_extension = g_slist_next(compression_type_extension)) {

    if (strcmp(extensionp, (const char *)compression_type_extension->data) == 0) {

      /*

       * Yes, so it's one of the compressed-file extensions.

       * Is there an extension before that?

       */

      if (ncomponents == 2) {

        g_slist_free(compression_type_extensions);

        g_strfreev(components);

        return NULL; /* no, only two components */

      }

      /*

       * Yes, return that extension.

       */

      g_slist_free(compression_type_extensions);

      extensionp = g_strdup(components[ncomponents - 2]);

      g_strfreev(components);

      return extensionp;

    }

  }

  g_slist_free(compression_type_extensions);

  /*

   * The extension isn't one of the compressed-file extensions;

   * return it.

   */

  extensionp = g_strdup(extensionp);

  g_strfreev(components);

  return extensionp;

}

/*

 * Check if file extension is used in this heuristic

 */

static bool

heuristic_uses_extension(unsigned int i, const char *extension)

{

  char **extensionp;

  /*

   * Does this file type *have* any extensions?

   */

  if (open_routines[i].extensions == NULL)

    return false; /* no */

  /*

   * Check each of them against the specified extension.

   */

  for (extensionp = open_routines[i].extensions_set; *extensionp != NULL;

      extensionp++) {

    if (strcmp(extension, *extensionp) == 0) {

      return true; /* it's one of them */

    }

  }

  return false; /* it's not one of them */

}

/*

 * Attempt to open the file corresponding to "wth" using the file format

 * handler in "candidate".

 *

 * Returns WTAP_OPEN_MINE upon success, WTAP_OPEN_NOT_MINE if the file is not

 * in a suitable format for "candidate", or WTAP_OPEN_ERROR if a failure

 * occurred while reading the input.

 */

static int

try_one_open(wtap *wth, const struct open_info *candidate, int *err, char **err_info)

{

  /* Seek back to the beginning of the file; the open routine for the

   * previous file type may have left the file position somewhere other

   * than the beginning, and the open routine for this file type will

   * probably want to start reading at the beginning.

   *

   * Initialize the data offset while we're at it.

   */

  if (file_seek(wth->fh, 0, SEEK_SET, err) == -1) {

    /* Error - give up */

    return WTAP_OPEN_ERROR;

  }

  /* Set wth with wslua data if any - this is how we pass the data to the

   * file reader, kinda like the priv member but not free'd later.

   * It's ok for this to copy a NULL.

   */

  wth->wslua_data = candidate->wslua_data;

  return candidate->open_routine(wth, err, err_info);

}

/*

 * Attempt to open the file corresponding to "wth".  If "type" is supplied

 * (i.e. other than WTAP_TYPE_AUTO), that will be the only type attempted.

 * Otherwise, heuristic detection of the file format will be performed,

 * possibly guided by the extension part of "filename".

 *

 * Returns WTAP_OPEN_MINE upon success, WTAP_OPEN_NOT_MINE if it was not

 * possible to determine a suitable format for the file, or WTAP_OPEN_ERROR if

 * a failure occurred while reading the input.

 */

static int

try_open(wtap *wth, unsigned int type, int *err, char **err_info)

{

  int result = WTAP_OPEN_NOT_MINE;

  unsigned i;

  char *extension;

  /* 'type' is 1-based. */

  if (type != WTAP_TYPE_AUTO && type <= open_info_arr->len) {

    /* Try only the specified type. */

    return try_one_open(wth, &open_routines[type - 1], err, err_info);

  }

  /* First, all file types that support magic numbers. */

  for (i = 0; i < heuristic_open_routine_idx && result == WTAP_OPEN_NOT_MINE; i++) {

    result = try_one_open(wth, &open_routines[i], err, err_info);

  }

  if (result != WTAP_OPEN_NOT_MINE) {

    return result;

  }

  /* Does this file's name have an extension? */

  extension = get_file_extension(wth->pathname);

  if (extension != NULL) {

    unsigned pass;

    /*

     * Yes, the filename has an extension.

     *

     * The heuristic types fall into one of three categories, which

     * we attempt in order by scanning for each category in turn.

     *

     * First pass selects the heuristic types that list this file's

     * extension, as these are most likely to be the correct choice

     * for this file.

     *

     * Second pass selects heuristic types which have no

     * extensions.  We try those before the ones that have

     * extensions that *don't* match this file's extension, on the

     * theory that files of those types generally have one of the

     * type's extensions, and, as this file *doesn't* have one of

     * those extensions, it's probably *not* one of those files.

     *

     * Third pass selects heuristic types which support extensions

     * but where none of them matches this file's extension.

     *

     * We need only continue searching until we find a match or an

     * error occurs.

     */

    for (pass = 0; pass < 3 && result == WTAP_OPEN_NOT_MINE; pass++) {

      for (i = heuristic_open_routine_idx; i < open_info_arr->len && result == WTAP_OPEN_NOT_MINE; i++) {

        if (   (pass == 0 && heuristic_uses_extension(i, extension))

            || (pass == 1 && open_routines[i].extensions == NULL)

            || (pass == 2 && open_routines[i].extensions != NULL

                          && !heuristic_uses_extension(i, extension))) {

          result = try_one_open(wth, &open_routines[i], err, err_info);

        }

      }

    }

    g_free(extension);

  } else {

    /* No extension.  Try all the heuristic types in order. */

    for (i = heuristic_open_routine_idx; i < open_info_arr->len && result == WTAP_OPEN_NOT_MINE; i++) {

      result = try_one_open(wth, &open_routines[i], err, err_info);

    }

  }

  return result;

}

/* Opens a file and prepares a wtap struct.

 * If "do_random" is true, it opens the file twice; the second open

 * allows the application to do random-access I/O without moving

 * the seek offset for sequential I/O, which is used by Wireshark

 * so that it can do sequential I/O to a capture file that's being

 * written to as new packets arrive independently of random I/O done

 * to display protocol trees for packets when they're selected.

 */

wtap *

wtap_open_offline(const char *filename, unsigned int type, int *err, char **err_info,

      bool do_random, const char* app_env_var_prefix)

{

  int fd;

  ws_statb64 statb;

  bool ispipe = false;

  wtap  *wth;

  bool use_stdin = false;

  wtap_block_t shb;

  *err = 0;

  *err_info = NULL;

  /* open standard input if filename is '-' */

  if (strcmp(filename, "-") == 0)

    use_stdin = true;

  /* First, make sure the file is valid */

  if (use_stdin) {

    if (ws_fstat64(0, &statb) < 0) {

      *err = errno;

      return NULL;

    }

  } else {

    if (ws_stat64(filename, &statb) < 0) {

      *err = errno;

      return NULL;

    }

  }

  if (S_ISFIFO(statb.st_mode)) {

    /*

     * Opens of FIFOs are allowed only when not opening

     * for random access.

     *

     * Currently, we do seeking when trying to find out

     * the file type, but our I/O routines do some amount

     * of buffering, and do backward seeks within the buffer

     * if possible, so at least some file types can be

     * opened from pipes, so we don't completely disallow opens

     * of pipes.

     */

    if (do_random) {

      *err = WTAP_ERR_RANDOM_OPEN_PIPE;

      return NULL;

    }

    ispipe = true;

  } else if (S_ISDIR(statb.st_mode)) {

    /*

     * Return different errors for "this is a directory"

     * and "this is some random special file type", so

     * the user can get a potentially more helpful error.

     */

    *err = EISDIR;

    return NULL;

  } else if (! S_ISREG(statb.st_mode)) {

    *err = WTAP_ERR_NOT_REGULAR_FILE;

    return NULL;

  }

  /*

   * We need two independent descriptors for random access, so

   * they have different file positions.  If we're opening the

   * standard input, we can only dup it to get additional

   * descriptors, so we can't have two independent descriptors,

   * and thus can't do random access.

   */

  if (use_stdin && do_random) {

    *err = WTAP_ERR_RANDOM_OPEN_STDIN;

    return NULL;

  }

  errno = ENOMEM;

  wth = g_new0(wtap, 1);

  /* Open the file */

  errno = WTAP_ERR_CANT_OPEN;

  if (use_stdin) {

    /*

     * We dup FD 0, so that we don't have to worry about

     * a file_close of wth->fh closing the standard

     * input of the process.

     */

    fd = ws_dup(0);

    if (fd < 0) {

      *err = errno;

      g_free(wth);

      return NULL;

    }

#ifdef _WIN32

    if (_setmode(fd, O_BINARY) == -1) {

      /* "Shouldn't happen" */

      *err = errno;

      g_free(wth);

      return NULL;

    }

#endif

    if (!(wth->fh = file_fdopen(fd))) {

      *err = errno;

      ws_close(fd);

      g_free(wth);

      return NULL;

    }

  } else {

    if (!(wth->fh = file_open(filename))) {

      *err = errno;

      g_free(wth);

      return NULL;

    }

  }

  if (do_random) {

    if (!(wth->random_fh = file_open(filename))) {

      *err = errno;

      file_close(wth->fh);

      g_free(wth);

      return NULL;

    }

  } else

    wth->random_fh = NULL;

  /* initialization */

  wth->ispipe = ispipe;

  wth->file_encap = WTAP_ENCAP_UNKNOWN;

  wth->subtype_sequential_close = NULL;

  wth->subtype_close = NULL;

  wth->file_tsprec = WTAP_TSPREC_USEC;

  nstime_set_unset(&wth->file_start_ts);

  nstime_set_unset(&wth->file_end_ts);

  wth->pathname = g_strdup(filename);

  wth->priv = NULL;

  wth->wslua_data = NULL;

  wth->shb_hdrs = g_array_new(false, false, sizeof(wtap_block_t));

  wth->app_env_var_prefix = app_env_var_prefix;

  shb = wtap_block_create(WTAP_BLOCK_SECTION);

  if (shb)

    g_array_append_val(wth->shb_hdrs, shb);

  /* Initialize the array containing a list of interfaces. pcapng_open and

   * erf_open needs this (and libpcap_open for ERF encapsulation types).

   * Always initing it here saves checking for a NULL ptr later. */

  wth->interface_data = g_array_new(false, false, sizeof(wtap_block_t));

  /*

   * Next interface data that wtap_get_next_interface_description()